Monitoring system

ABSTRACT

In a monitoring system for mutually monitoring first and second control devices, when the first and second control devices detect an abnormality in a counterpart control device respectively, the first and second control devices output, to a monitoring reset unit, a reset request signal that matches a reference reset request signal for the counterpart control device, and the monitoring reset unit resets the counterpart control device when the reset request signal for the counterpart control device from the first and second control devices matches the reference reset request signal.

CROSS-REFERENCE TO RELATED APPLICATION

The present disclosure claims priority to Japanese Patent ApplicationNo. 2017-6831 filed on Jan. 18, 2017, which is incorporated herein byreference in its entirety including specification, drawings and claims.

TECHNICAL FIELD

The present disclosure relates to a monitoring system, and moreparticularly, to a monitoring system for mutually monitoring first andsecond control devices.

BACKGROUND

As a monitoring system of this type, a system for mutually monitoring amain microcomputer and a sub microcomputer has heretofore been proposed(e.g., see JP2014-102662A). In this monitoring system, the submicrocomputer receives a first pulse signal from the main microcomputer,calculates a frequency of the first pulse signal, and transmits a resetsignal to the main microcomputer when the frequency deviates from afirst normal frequency range, to thereby reset the main microcomputer.Further, the main microcomputer receives a second pulse signal from thesub microcomputer, calculates a frequency of the second pulse signal,and transmits a reset signal to the sub microcomputer when the frequencydeviates from a second normal frequency range, to thereby reset the submicrocomputer.

CITATION LIST Patent Literature

PTL1: JP2014-102662A

SUMMARY

In the monitoring system described above, when one of the mainmicrocomputer and the sub microcomputer is in an abnormal state, it isdetermined that the frequency of a pulse signal from the other one ofthe microcomputers deviates from a normal frequency range, regardless ofwhether or not the frequency of the pulse signal from the other one ofthe microcomputers falls within the normal frequency range, so that theother one of the microcomputers may be erroneously reset.

A principle object of a monitoring system according to the presentdisclosure is to prevent first and second control devices from beingerroneously reset.

Solution to Problem

In order to achieve the above object, the monitoring system of thedisclosure is implemented by an aspect described below.

The present disclosure is directed to a monitoring system. Themonitoring system for mutually monitoring first and second controldevices, the monitoring system including a monitoring reset unitconfigured to monitor the first and second control devices and reset thefirst and second control devices. When the first and second controldevices detect an abnormality in a counterpart control device, the firstand second control devices output, to the monitoring reset unit, a resetrequest signal that matches a reference reset request signal for thecounterpart control device, respectively, and the monitoring reset unitresets the counterpart control device when the reset request signal forthe counterpart control device from the first and second control devicesmatches the reference reset request signal.

In the monitoring system according to the present disclosure, when thefirst and second control devices detect an abnormality in thecounterpart control device, the first and second control devices output,to the monitoring reset unit, the reset request signal that matches thereference reset request signal for the counterpart control device. Whenthe reset request signal for the counterpart control device from thefirst and second control devices matches the reference reset requestsignal, the monitoring reset unit resets the counterpart control device.With this configuration, it is considered that, when one of the firstand second control devices is in the abnormal state, the reset requestsignal from the counterpart (the other) control device that is outputfrom the one of the control devices to the monitoring reset unit doesnot match the reference reset request signal. Thus, when one of thecontrol devices is in the abnormal state, the counterpart control devicecan be prevented from being erroneously reset due to the abnormality.

BRIEF DESCRIPTION OF DRAWINGS

FIG. 1 is a block diagram schematically illustrating a configuration ofa monitoring system 20 as an embodiment of the present disclosure;

FIG. 2 is a flowchart illustrating an example of a second microcomputerprocessing routine;

FIG. 3 is a flowchart illustrating an example of a monitoringmicrocomputer processing routine;

FIG. 4 is an explanatory diagram illustrating a reference first resetrequest signal;

FIGS. 5A to 5C are explanatory diagrams each illustrating an example ofa first reset request signal;

FIG. 6 is a block diagram schematically illustrating a configuration ofa monitoring system 120 according to a modified example;

FIG. 7 is a block diagram schematically illustrating a configuration ofa monitoring system 220 according to another modified example;

FIG. 8 is a block diagram schematically illustrating a configuration ofa monitoring system 320 according to still another modified example;

FIG. 9 is an explanatory diagram illustrating an example of an operationof the monitoring system 220 when a first microcomputer monitoring unit42 of a second microcomputer 40 detects that a first microcomputer 30 isin an abnormal state; and

FIG. 10 is an explanatory diagram illustrating an example of anoperation of the monitoring system 320 when the first microcomputermonitoring unit 42 of the second microcomputer 40 detects that the firstmicrocomputer 30 is in the abnormal state.

DESCRIPTION OF EMBODIMENTS

The following describes aspects of the disclosure with reference to someembodiments.

Embodiments

FIG. 1 is a block diagram schematically illustrating a configuration ofa monitoring system 20 as an embodiment of the present disclosure. Asillustrated in FIG. 1, the monitoring system 20 is configured as amonitoring system for mutually monitoring first and secondmicrocomputers (hereinafter referred to as “microcomputers”) 30 and 40as first and second control devices, respectively, for driving andcontrolling first and second motors 10 and 11, respectively, andincludes a monitoring microcomputer 50 as a monitoring reset unit, aswell as the first and second microcomputers 30 and 40. The monitoringsystem 20 is mounted on an electric vehicle or a hybrid vehicleincluding the first and second motors 10 and 11, first and secondinverters 12 and 13 for driving the first and second motors 10 and 11,respectively, and a battery 14 that exchanges power with the first andsecond motors 10 and 11 through the first and second inverters 12 and13, respectively. The first and second motors 10 and 11 are eachconfigured as a synchronous generator-motor. A monitoring IC may be usedinstead of the monitoring microcomputer 50.

The first and second microcomputers 30 and 40 and the monitoringmicrocomputer 50 are configured as a CPU-based microprocessor andinclude a ROM configured to store processing programs, a RAM configuredto temporarily store data, input/output ports and a communication port,respectively, in addition to the CPU, although not being illustrated.The first and second microcomputers 30 and 40 and the monitoringmicrocomputer 50 are connected via the respective communication ports.

The first and second microcomputers 30 and 40 receive rotationalpositions θm1 and θm2 from a rotational position detection sensor fordetecting a rotational position of a rotor of each of the first andsecond motors 10 and 11, phase currents Iu1, Iv1, Iu2, and Iv2 from acurrent sensor for detecting a current flowing through each phase of thefirst and second motors 10 and 11, and the like through an input port.The first and second microcomputer 30 and 40 output a switching controlsignal and the like to a plurality of switching elements of the firstand second inverters 12 and 14 through an output port.

The first and second microcomputers 30 and 40 include, as functionalblocks, second and first microcomputer monitoring units 32 and 42 andsecond and first microcomputer reset requesting units 34 and 44,respectively. In this case, the second and first microcomputermonitoring units 32 and 42 monitor the second and first microcomputers40 and 30 (determine whether the second and first microcomputers are ina normal state or in an abnormal state). The second and firstmicrocomputer reset requesting units 34 and 44 output, to the monitoringmicrocomputer 50, second and first reset request signals (reset requestsignals for the second and first microcomputers 40 and 30),respectively, based on monitoring results (determination results) of thesecond and first microcomputers 40 and 30 by the second and firstmicrocomputer monitoring units 32 and 42. The second and first resetrequest signals are voltage signals each having a logical level of a Lolevel or a Hi level.

The monitoring microcomputer 50 includes, as functional blocks, firstand second microcomputer reset determination units 51 and 52 and firstand second microcomputer reset control units 53 and 54. In this case,the first and second microcomputer reset determination units 51 and 52determine whether or not the first and second microcomputers 30 and 40are reset based on first and second reset request signals from the firstand second microcomputer reset requesting units 44 and 34, respectively.The first and second microcomputer reset control units 53 and 54 output,to the first and second microcomputers 30 and 40, respectively, firstand second reset instruction signals (reset instruction signals for thefirst and second microcomputers 30 and 40) based on the determinationresults obtained by the first and second microcomputer resetdetermination units 51 and 52. The first and second reset instructionsignals are voltage signals each having a logical level of the Hi levelor the Lo level. When the first and second reset instruction signals areat the Lo level, the first and second microcomputers 30 and 40 are reset(restarted).

In the monitoring system 20 according to the embodiment having theconfiguration described above, when the first and second microcomputers30 and 40 control switching of the plurality of switching elements ofthe first and second inverters 12 and 13 to drive and control the firstand second motors 10 and 11, the first and second microcomputers 30 and40 execute the following processes (A1) to (A7):

(A1) a process of acquiring the rotational positions θm1 and θm2 of therotors of the first and second motors 10 and 11, and the phase currentsIu1, Iv1, Iu2, and Iv2 of the respective phases;

(A2) a process of converting the rotational positions θm1 and θm2 of therotors of the first and second motors 10 and 11 into electrical anglesθe1 and θe2;

(A3) a process of performing a coordinate conversion (three-phase totwo-phase conversion) of the phase currents Iu1, Iv1, Iu2, and Iv2 ofthe respective phases of the first and second motors 10 and 11 intod-axis and q-axis currents Id1, Iq1, Id2, and Iq2 by using theelectrical angles θe1, θe2 of the first and second motors 10 and 11;

(A4) a process of setting d-axis and q-axis current commands Id1*, Iq1*,Id2*, and Iq2* based on torque commands Tm1* and Tm2* of the first andsecond motors 10 and 11;

(A5) A process of setting d-axis and q-axis voltage commands Vd1*, Vq1*,Vd2*, and Vq2* by using the d-axis and q-axis currents Id1, Iq1, Id2,and Iq2 and the current commands Id1*, Iq1*, Id2*, and Iq2*;

(A6) A process of performing a coordinate conversion (two-phase tothree-phase conversion) of the d-axis and q-axis voltage commands Vd1*,Vq1*, Vd2*, and Vq2* into voltage commands Vu1*, Vv1*, Vw1*, Vu2*, Vv2*,and Vw2* of the respective phases; and

(A7) A process of generating PWM signals for the first and secondinverters 12 and 13 by using the voltage commands Vu1*, Vv1*, Vw1*,Vu2*, Vv2*, and Vw2* of the respective phases, and outputting thegenerated PWM signals to the first and second inverters 12 and 13.

Next, the operation of the monitoring system 20 according to theembodiment having the configuration described above will be described.The first and second microcomputers 30 and 40 execute first and secondmicrocomputer processing routines, respectively, and the monitoringmicrocomputer 50 executes a monitoring microcomputer processing routine.These routines are repeatedly executed. FIG. 2 illustrates an example ofthe second microcomputer processing routine, and FIG. 3 illustrates anexample of the monitoring microcomputer processing routine. Theseroutines are sequentially described below. It can be considered that thefirst microcomputer processing routine is similar to the secondmicrocomputer processing routine.

When the second microcomputer processing routine illustrated in FIG. 2is executed, the second microcomputer 40 executes periodical processing(step S100). Examples of the periodical processing executed by thesecond microcomputer 40 include a communication process between thefirst microcomputer 30 and the second microcomputer 40, as well as theabove-described processes (A1) to (A7).

Next, it is determined whether or not the periodical processing isnormally finished (step S110). When it is determined that the periodicalprocessing is not normally finished, the first microcomputer resetrequesting unit 44 terminates this routine without switching the Lo/Hilevel of the first reset request signal (reset request signal for thefirst microcomputer 30) (the first reset request signal is held withoutbeing inverted).

In step S110, when it is determined that the periodical processing isnormally finished, the first microcomputer monitoring unit 42 determineswhether the first microcomputer 30 is in the normal state or in theabnormal state (step S120). The process of step S120 can be performedby, for example, acquiring the electrical angle θe1 of the first motor10, the phase currents Iu1 and Iv1 of the respective phases, and thetorque command Tm1* from each sensor and the first microcomputer 30,estimating the output torque Tm1 of the first motor 10 based on theelectrical angle θe1 and the phase currents Iu1 and Iv1, and comparingthe torque command Tm1* with the output torque Tm1 to determine whetheror not the first motor 10 is normally driven and controlled. When thefirst microcomputer monitoring unit 42 determines that the firstmicrocomputer 30 is in the normal state, the first microcomputer resetrequesting unit 44 terminates this routine without switching the Lo/Hilevel of the first reset request signal.

In step S120, when the first microcomputer monitoring unit 42 determinesthat the first microcomputer 30 is in the abnormal state, the firstmicrocomputer reset requesting unit 44 determines whether or not aswitch timing for switching the Lo/Hi level of the first reset requestsignal is reached (step S130). In this case, the switch timing isdetermined in such a manner that the first reset request signal matchesa reference first reset request signal described later.

In step S130, when it is determined that the switch timing is notreached, the first microcomputer reset requesting unit 44 terminatesthis routine without switching the Lo/Hi level of the first resetrequest signal. On the other hand, when it is determined that the switchtiming is reached, the first microcomputer reset requesting unit 44switches the Lo/Hi level of the first reset request signal (step S140),and terminates this routine.

Accordingly, in the second microcomputer 40, when the firstmicrocomputer monitoring unit 42 determines (detects) that the firstmicrocomputer 30 is in the abnormal state, the first microcomputer resetrequesting unit 44 switches the Lo/Hi level of the first reset requestsignal at the above-mentioned switch timing, thereby setting the firstreset request signal as the signal that matches the reference firstreset request signal. Similarly, in the first microcomputer 30, when thesecond microcomputer monitoring unit 32 determines (detects) that thesecond microcomputer 40 is in the abnormal state, the second resetrequest signal is set as the signal that matches the reference secondreset request signal.

The reference first and second reset request signals will now bedescribed. The reference first reset request signal is stored in ROMs,which are not illustrated, of the first microcomputer 30 and themonitoring microcomputer 50, and the reference second reset requestsignal is stored in ROMs, which are not illustrated, of the secondmicrocomputer 40 and the monitoring microcomputer 50. In the embodiment,the reference first and second reset request signals (which are the samesignal) illustrated in FIG. 4 are used as the reference first and secondreset request signals, respectively. In FIG. 4, a predetermined periodΔta (a scale interval of a horizontal axis) is a time (the same time)required for executing the periodical processing by the first and secondmicrocomputers 30 and 40. The predetermined period Δta is, for example,2 msec, 2.5 msec, or 3 msec. In this case, examples of the periodicalprocessing executed by the first microcomputer 30 include acommunication process between the first microcomputer 30 and the secondmicrocomputer 40, as well as the above-described processes (A1) to (A7),like the periodical processing executed by the second microcomputer 40.The time required for executing the periodical processing by the firstmicrocomputer 30 may be different from the time required for executingthe periodical processing by the second microcomputer 40, and thereference first and second reset request signals may be different fromeach other.

As illustrated in FIG. 4, each of the reference first and second resetrequest signals is a signal having a predetermined pulse train,specifically, a signal having a pulse train including one pulse having apulse number 0, a predetermined period Ta1, and Na number of pulses ofpulse numbers 1 to Na (Na≥2) in this order. The pulses of the pulsenumbers 0 to Na are generated by switching the signal from the Lo levelto the Hi level (rising edge) and switching the signal from the Hi levelto the Lo level (falling edge). The time of each of the pulses of thepulse numbers 0 to Na (time when the signal is at the Hi level) and eachcycle (an interval of a rising edge) of two continuous pulses of thepulse numbers 1 to Na are twice as long as the predetermined period Δta.The predetermined period Ta1 is an interval between the pulse of thepulse number 0 and the pulse of the pulse number 1. For example, 15times, 18 times, or 21 times as long as the predetermined period Δta canbe used. As the value Na, for example, 7, 10, or 13 can be used. Apredetermined period Ta2 illustrated in FIG. 4 is a time from a risingedge of the pulse of the pulse number 1 to a rising edge of the pulse ofthe pulse number Na, and is represented by “Δta×(Na−1)×2”.

Next, the monitoring microcomputer processing routine illustrated inFIG. 3 will be described. When this routine is executed, in themonitoring microcomputer 50, the first microcomputer reset determinationunit 51 determines whether or not a first determination condition issatisfied (step S300). In this case, the first determination conditionis a condition for determining whether or not the first reset requestsignal from the first microcomputer reset requesting unit 44 of thesecond microcomputer 40 matches the reference first reset requestsignal. When it is determined that the first determination condition issatisfied, it is determined whether or not the first reset requestsignal matches the reference first reset request signal (steps S302 andS304).

The determination as to whether or not the first determination conditionis satisfied can be made by, for example, determining whether or not thefollowing conditions (B1) and (B2) are satisfied for the first resetrequest signal.

(B1) A condition in which a time (Δta+Ta1+Ta2) from a rising edge of thepulse of the pulse number 0 has elapsed

(B2) A condition in which pulses are continuously generated (theinterval between a rising edge of the latest pulse and a rising edge ofthe pulse immediately before the latest pulse is twice as long as thepredetermined period Δta)

The determination as to whether or not the first reset request signalmatches the reference first reset request signal is made by, forexample, determining whether or not the following conditions (C1) and(C2) are satisfied for the first reset request signal.

(C1) A condition in which the interval between a rising edge of thepulse of the pulse number 0 and a rising edge of the pulse of the pulsenumber 1 is equal to the time (Δta+Ta1)

(C2) A condition in which a timing when the time (Δta+Ta1+Ta2) from arising edge of the pulse of the pulse number 0 has elapsed is equal to atiming of a rising edge of the pulse of the pulse number Na

In step S300, when it is determined that the first determinationcondition is not satisfied, and when it is determined in step S300 thatthe first determination condition is satisfied and it is determined insteps S302 and S304 that the first reset request signal does not matchthe reference first reset request signal, the first microcomputer resetcontrol unit 53 sets the first reset instruction signal (resetinstruction signal for the first microcomputer 30) to the Hi level (stepS310). When it is determined in steps S302 and S304 that the first resetrequest signal does not match the reference first reset request signal,the pulse number may be reset, for example, when the above-mentionedcondition (B2) is not satisfied, in case the first microcomputermonitoring unit 42 thereafter detects an abnormality in the firstmicrocomputer 30.

When it is determined in step S300 that the first determinationcondition is satisfied, and when it is determined in steps S302 and S304that the first reset request signal matches the reference first resetrequest signal, the first microcomputer reset control unit 53 sets thefirst reset instruction signal to the Lo level (step S320).

Thus, when the first reset instruction signal is switched from the Hilevel to the Lo level, the first microcomputer 30 starts resetting(starts to restart). Further, the first microcomputer 30 continuesresetting for a period in which the first reset instruction signal isheld at the Lo level, and then the first microcomputer 30 is restored(restart is completed) when the first reset instruction signal isswitched from the Lo level to the Hi level. The first reset instructionsignal is switched from the Lo level to the Hi level, for example, whenthe above-mentioned condition (B2) is not satisfied and it is determinedin step S300 that the first determination condition is not satisfied.

Next, the second microcomputer reset determination unit 52 determineswhether or not the second determination condition is satisfied (stepS330). In this case, the second determination condition is a conditionfor determining whether or not the second reset request signal from thesecond microcomputer reset requesting unit 34 of the first microcomputer30 matches the reference second reset request signal. Further, when itis determined that the second determination condition is satisfied, itis determined whether or not the second reset request signal matches thereference second reset request signal (steps S332 and S334). Thedetermination process of steps S330 to S334 can be performed in a mannersimilar to the determination process of steps S300 to S304.

When it is determined in step S330 that the second determinationcondition is not satisfied, or when it is determined in step S330 thatthe second determination condition is satisfied and it is determined insteps S332 and S334 that the second reset request signal does not matchthe reference second reset request signal, the second microcomputerreset control unit 54 sets the second reset instruction signal to the Hilevel (step S340), and terminates this routine.

When it is determined in step S330 that the second determinationcondition is satisfied and it is determined in steps S332 and S334 thatthe second reset request signal matches the reference second resetrequest signal, the second microcomputer reset control unit 54 sets thesecond reset instruction signal to the Lo level (step S350), andterminates the routine.

In this manner, when the second reset instruction signal is switchedfrom the Hi level to the Lo level, the second microcomputer 40 startsresetting (starts to restart). Further, the second microcomputer 40continuously performs resetting for a period in which the second resetinstruction signal is held at the Lo level, and then the secondmicrocomputer 40 is restored (restart is completed) when the secondreset instruction signal is switched from the Lo level to the Hi level.

In the embodiment, when the second microcomputer 40 is in the abnormalstate, it is considered that the first reset request signal output fromthe second microcomputer 40 to the monitoring microcomputer 50 does notmatch the reference first reset request signal. Thus, when the secondmicrocomputer 40 is in the abnormal state, the first microcomputer 30can be prevented from being erroneously reset due to the abnormal state.In addition, a signal having a predetermined pulse train is used as thereference first reset request signal, and a signal having a pulse trainincluding one pulse, the predetermined period Ta1, and Na number ofpulses in this order is used as the signal having the predeterminedpulse train, thereby preventing the first reset request signal frommatching the reference first reset request signal when the secondmicrocomputer 40 is in the abnormal state. Note that when the secondmicrocomputer 40 is in the abnormal state and the abnormal state of thesecond microcomputer 40 is detected by the second microcomputermonitoring unit 32 of the first microcomputer 30, the secondmicrocomputer reset requesting unit 34 outputs the second reset requestsignal that matches the reference second reset request signal. Further,when the second microcomputer reset determination unit 52 of themonitoring microcomputer 50 determines that the second reset requestsignal matches the reference second reset request signal, the secondmicrocomputer reset control unit 54 sets the second reset instructionsignal to the Lo level. As a result, the second microcomputer 40 isreset. The same holds true when the first microcomputer 30 is in theabnormal state.

FIGS. 5A to 5C are explanatory diagrams each illustrating an example ofthe first reset request signal. In examples illustrated in FIGS. 5A to5C, the value Na of 10 is used to determine whether or not the firstdetermination condition is satisfied, by using the above-mentionedconditions (B1) and (B2), and it is determined whether or not the firstreset request signal matches the reference first reset request signal,by using the above-mentioned conditions (C1) and (C2). When theconditions (B1) and (B2) are satisfied, in the case of FIG. 5A, theconditions (C1) and (C2) are satisfied. Accordingly, it is determinedthat the first reset request signal matches the reference first resetrequest signal and the first reset instruction signal is set to the Lolevel. As a result, the first microcomputer 30 is reset. In the case ofFIG. 5B, the condition (C1) is satisfied, but the condition (C2) is notsatisfied. Accordingly, it is determined that the first reset requestsignal does not match the reference first reset request signal, and thefirst reset instruction signal is held at the Hi signal. Thus, the firstmicrocomputer 30 is not reset. In the case of FIG. 5C, the conditions(C1) and (C2) are not satisfied. Accordingly, it is determined that thefirst reset request signal does not match the reference first resetrequest signal, and the first reset instruction signal is held at the Hisignal. Thus, the first microcomputer 30 is not reset.

In the monitoring system 20 according to the embodiment described above,in the first and second microcomputers 30 and 40, when the second andfirst microcomputer monitoring units 32 and 42 determine (detect) theabnormal states of the second and first microcomputers 40 and 30, thesecond and first reset request signals that match the reference secondand first reset request signals, respectively, are output to themonitoring microcomputer 50 from the second and first microcomputerreset requesting units 34 and 44. In the monitoring microcomputer 50,the first and second microcomputer reset determination units 51 and 52determine whether or not the second and first reset request signals fromthe second and first microcomputer reset requesting units 34 and 44match the reference second and first reset request signals,respectively, and when the second and first reset request signals matchthe reference second and first reset request signals, respectively, thefirst and second microcomputers 30 and 40 are reset. With thisconfiguration, for example, when the second microcomputer 40 is in theabnormal state, it is considered that the first reset request signaloutput from the second microcomputer 40 to the monitoring microcomputer50 does not match the reference first reset request signal. Thus, whenthe second microcomputer 40 is in the abnormal state, the firstmicrocomputer 30 can be prevented from being erroneously reset due tothe abnormality. The same holds true when the first microcomputer 30 isin the abnormal state. Specifically, when one of the first and secondmicrocomputers 30 and 40 is in the abnormal state, the counterpartcontrol device can be prevented from being erroneously reset due to theabnormality.

In addition, signals having a predetermined pulse train are used as thereference first and second reset request signals. Further, a signalhaving a pulse train including one pulse, the predetermined period Ta1,and Na number of pulses in this order is used as the signal having thepredetermined pulse train. With this configuration, when the secondmicrocomputer 40 is in the abnormal state, the first reset requestsignal can be prevented from matching the reference first reset requestsignal. The same holds true when the first microcomputer 30 is in theabnormal state.

In the monitoring system 20 according to the embodiment, signals havinga predetermined pulse train, specifically, signals having a pulse trainincluding one pulse, the predetermined period Ta1, and Na (Na≥2) numberof pulses in this order are used as the reference first and second resetrequest signals. However, the number of pulses prior to thepredetermined period Ta1 is not limited to one, but instead may be twoor more; the number of pulses after the predetermined period Ta1 is notlimited to Na, but instead may be one; the predetermined period Ta1 maybe omitted; and the time of each pulse, or each cycle of two continuouspulses may vary depending on the number of pulses.

In the monitoring system 20 according to the embodiment, signals havinga predetermined pulse train is used as the reference first and secondreset request signals. However, signals other than the signals havingthe predetermined pulse train may be used as the reference first andsecond reset request signals, as long as it can be determined whether ornot the first and second reset request signals match the reference firstand second reset request signals.

In the monitoring system 20 according to the embodiment, when the firstdetermination condition is not satisfied, or when the firstdetermination condition is satisfied and the first reset request signaldoes not match the reference first reset request signal, the monitoringmicrocomputer 50 sets the first reset instruction signal to the Hilevel, and when the first determination condition is satisfied and thefirst reset request signal matches the reference first reset requestsignal, the monitoring microcomputer 50 sets the first reset instructionsignal to the Lo level (the first microcomputer 30 is reset).Specifically, when the first determination condition is not satisfiedafter the first reset instruction signal is switched from the Hi levelto the Lo level, the first reset instruction signal is immediatelyswitched to the Hi level. However, when the first reset instructionsignal is switched from the Hi level to the Lo level, the first resetinstruction signal may be held at the Hi level until a predeterminedperiod has passed, regardless of whether the first determinationcondition is not satisfied. Thus, the first reset instruction signal canbe prevented from being switched frequently.

As illustrated in FIG. 1, the monitoring system 20 according to theembodiment includes the monitoring microcomputer 50 as well as the firstand second microcomputers 30 and 40. However, monitoring systems 120,220, and 320 according to modified examples illustrated in FIGS. 6, 7,and 8, respectively, may be employed. The monitoring systems 120, 220,and 320 will be described below in this order.

The monitoring system 120 illustrated in FIG. 6 will be described. Asillustrated in FIG. 6, the monitoring system 120 includes a monitoringmicrocomputer 150 and a reset instruction microcomputer 160, in additionto the first and second microcomputers 30 and 40.

The monitoring microcomputer 150 includes first and second microcomputerreset control units 153 and 154 as functional blocks. When power issupplied from a power supply, which is not illustrated, to themonitoring microcomputer 150, the first and second microcomputer resetcontrol units 153 and 154 set first and second power supply signals tobe output to NAND circuits 163 and 164 of the reset instructionmicrocomputer 160 to the Hi level, respectively. When no power issupplied to the monitoring microcomputer 150, the first and second powersupply signals are set to the Lo level.

The reset instruction microcomputer 160 includes, as functional blocks,first and second microcomputer reset determination units 161 and 162 andNAND circuits 163 and 164.

Like the first and second microcomputer reset determination units 51 and52 of the monitoring microcomputer 50 in the monitoring system 20, thefirst and second microcomputer reset determination units 161 and 162determine whether or not the first and second reset request signals fromthe first and second microcomputer reset requesting units 44 and 34 ofthe second and first microcomputers 40 and 30 match the reference firstand second reset request signals, respectively. When it is determinedthat the first and second reset request signals do not match thereference first and second reset request signals, respectively, firstand second reset determination signals (reset determination signals forthe first and second microcomputers 30 and 40) to be output to the NANDcircuits 163 and 164, respectively, are set to the Lo level. When it isdetermined that the first and second reset request signals match thereference first and second reset request signals, respectively, thefirst and second reset determination signals are set to the Hi level.

When the first and second power supply signals from the first and secondmicrocomputer reset control units 153 and 154 and the first and secondreset determination signals from the first and second microcomputerreset determination units 161 and 162 are at the Hi level, the NANDcircuits 163 and 164 set the first and second reset instruction signalsoutput to the first and second microcomputers 30 and 40, respectively,to the Lo level. In the other cases, the first and second resetinstruction signals are set to the Hi level. When the first and secondreset instruction signals are at the Lo level, the first and secondmicrocomputers 30 and 40 are reset.

Like in the configuration of the monitoring system 20 according to theembodiment, also in the configuration of the monitoring system 120 asdescribed above, when one of the first and second microcomputers 30 and40 is in the abnormal state, the counterpart control device can beprevented from being erroneously reset due to the abnormality.

Next, the monitoring system 220 illustrated in FIG. 7 will be described.As illustrated in FIG. 7, the monitoring system 220 includes theabove-mentioned monitoring microcomputer 150, watchdog timers (WDTs) 261and 262, counters 263 and 264, prescribed number determination circuits265 and 266, AND circuits 267 and 268, and NAND circuits 269 and 270, inaddition to the first and second microcomputers 30 and 40.

The watchdog timers 261 and 262 monitor the pulse cycle of the first andsecond reset request signals from the first and second microcomputerreset requesting units 44 and 34. Further, first and second pulsecontinuous signals to be output to the counters 263 and 264 and the ANDcircuits 267 and 268 are switched from the Lo level to the Hi level whenthe pulse cycle of the first and second reset request signals (aninterval between the latest pulse and the pulse immediately before thelatest pulse) is equal to the time (Δta+Ta1) (see FIG. 4). After that,when the pulse cycle is equal to a predetermined period Δta (see FIG.4), the signal is held at the Hi level, and when the pulse cycle is notequal to the predetermined period Δta, the signal is switched to the Lolevel.

When the first and second pulse continuous signals from the watchdogtimers 261 and 262 are at the Lo level, the counters 263 and 264 holdthe first and second count values at the value 0, respectively. When thefirst and second pulse continuous signals are at the Hi level, thenumber of pulses of the first and second reset request signals iscounted as the first and second count values, and the first and secondcount values are output to the prescribed number determination circuits265 and 266, respectively.

The prescribed number determination circuits 265 and 266 determinewhether or not the first and second count values from the counters 263and 264 have reached first and second prescribed numbers, respectively.When the first and second count values are less than the first andsecond prescribed numbers, respectively, first and second prescribednumber determination signals to be output to the AND circuits 267 and268 are set to the Lo level. When the first and second count values areequal to or greater than the first and second prescribed number,respectively, the first and second prescribed number determinationsignals are set to the Hi level.

When the first and second pulse continuous signals from the watchdogtimers 261 and 262 and the first and second prescribed numberdetermination signals from the prescribed number determination circuits265 and 266 are at the Hi level, the AND circuits 267 and 268 set thefirst and second reset determination signals to be output to the NANDcircuits 269 and 270 to the Hi level. In the other cases, the first andsecond reset determination signals are set to the Lo level. Switchingthe first and second reset determination signals from the Lo level tothe Hi level means that the first and second reset request signals match(are considered to match) the reference first and second reset requestsignals, respectively.

When the first and second power supply signals from the first and secondmicrocomputer reset control units 153 and 154 and the first and secondreset determination signals from the AND circuits 267 and 268 are at theHi level, the NAND circuits 269 and 270 set the first and second resetinstruction signals to be output to the first and second microcomputers30 and 40 to the Lo level. In the other cases, the first and secondreset instruction signals are set to the Hi level. When the first andsecond reset instruction signals are at the Lo level, the first andsecond microcomputers 30 and 40 are reset, respectively.

FIG. 9 is an explanatory diagram illustrating an example of an operationof the monitoring system 220 when a first microcomputer monitoring unit42 of a second microcomputer 40 detects that a first microcomputer 30 isin an abnormal state. When the first microcomputer monitoring unit 42 ofthe second microcomputer 40 detects the abnormal state of the firstmicrocomputer 30, the first microcomputer reset requesting unit 44starts to output the first reset request signal that matches thereference first reset request signal. When determining that the pulsecycle of the first reset request signal is equal to the predeterminedperiod Ta1 (time t11), the watchdog timer 261 switches the first pulsecontinuous signal from the Lo level to the Hi level. Accordingly, thecounter 263 starts to count the number of pulses of the first resetrequest signal as the first count value. After that, when determiningthat the pulse cycle of the first reset request signal is equal to thepredetermined period Δta, the watchdog timer 261 holds the first pulsecontinuous signal at the Hi level. Further, when the first count valuereaches the first prescribed number or greater (time t12), theprescribed number determination circuit 265 switches the firstprescribed number determination signal from the Lo level to the Hilevel. As a result, the first pulse continuous signal and the firstprescribed number determination signal are set to the Hi level; thefirst reset determination signal from the AND circuit 267 is switchedfrom the Lo level to the Hi level; and the first reset instructionsignal from the NAND circuit 269 is switched to the Lo level, so thatthe first microcomputer 30 is reset.

Like in the configuration of the monitoring system 20 according to theembodiment, also in the configuration of the monitoring system 220 asdescribed above, when one of the first and second microcomputers 30 and40 is in the abnormal state, the counterpart control device can beprevented from being erroneously reset due to the abnormality. Thewatchdog timers 261 and 262, the counters 263 and 264, the prescribednumber determination circuits 265 and 266, the AND circuits 267 and 268,and the NAND circuits 269 and 270 may be implemented by hardware using ageneral-purpose IC, or similar functions may be implemented by softwareusing a microcomputer or the like.

Next, the monitoring system 320 illustrated in FIG. 8 will be described.As illustrated in FIG. 8, the monitoring system 320 includes theabove-mentioned monitoring microcomputer 150, gradual change processingunits 361 and 362, comparison determination units 363 and 364, and NANDcircuits 365 and 366, in addition to the first and second microcomputers30 and 40.

The gradual change processing units 361 and 362 perform gradual changeprocessing (annealing processing or rate processing) on the first andsecond reset request signals (voltage of Lo/Hi level) from the first andsecond microcomputer reset requesting units 44 and 34 of the second andfirst microcomputers 40 and 30 to generate first and second processedvoltages, and outputs the first and second processed voltages to thecomparison determination units 363 and 364, respectively.

The comparison determination units 363 and 364 determine whether or notthe first and second processed voltages from the gradual changeprocessing units 361 and 362, respectively, are within the range offirst and second upper/lower limit determination thresholds. When thefirst and second processed voltages fall outside of the first and secondupper/lower limit determination thresholds, respectively, or when thefirst and second processed voltages are not continuous over apredetermined period although the first and second processed voltagesfall within the first and second upper/lower limit determinationthresholds, the first and second reset determination signals to beoutput to the NAND circuits 365 and 366 are set to the Lo level. Whenthe processed voltages are continuous over the predetermined periodwithin the range of the upper/lower limit determination thresholds, thefirst and second reset determination signals are set to the Hi level.The first and second upper/lower limit determination thresholds aredetermined to be voltages slightly lower than a Hi-level voltage, andthe first and second lower limit determination thresholds are determinedto be voltages slightly higher than a Lo-level voltage. Switching of thefirst and second reset determination signals from the Lo level to the Hilevel means that the first and second reset request signals match (areconsidered to match) the reference first and second reset requestsignals.

When the first and second power supply signals from the first and secondmicrocomputer reset control units 153 and 154 and the first and secondreset determination signals from the comparison determination units 363and 364 are at the Hi level, the NAND circuits 365 and 366 set the firstand second reset instruction signals to be output to the first andsecond microcomputers 30 and 40 to the Lo level, respectively. In theother cases, the first and second reset instruction signals are set tothe Hi level. When the first and second reset instruction signals are atthe Lo level, the first and second microcomputers 30 and 40 are reset.

FIG. 10 is an explanatory diagram illustrating an example of anoperation of the monitoring system 320 when the first microcomputermonitoring unit 42 of the second microcomputer 40 detects that the firstmicrocomputer 30 is in the abnormal state. When the first microcomputermonitoring unit 42 of the second microcomputer 40 detects the abnormalstate of the first microcomputer 30, the first microcomputer resetrequesting unit 44 starts to output the first reset request signal thatmatches the reference first reset request signal. When the processedvoltages are continuous over the predetermined period within theupper/lower limit determination thresholds (time t21), the comparisondetermination unit 363 switches the first reset determination signalfrom the Lo level to the Hi level. As a result, the first resetinstruction signal from the NAND circuit 365 is switched to the Lolevel, and the first microcomputer 30 is reset.

Like in the configuration of the monitoring system 20 according to theembodiment, also in the configuration of the monitoring system 320 asdescribed above, when one of the first and second microcomputers 30 and40 is in the abnormal state, the counterpart control device can beprevented from being erroneously reset due to the abnormality. Thegradual change processing units 361 and 362, the comparisondetermination units 363 and 364, and the NAND circuits 365 and 366 maybe implemented by hardware using a general-purpose IC, or similarfunctions may be implemented by software using a microcomputer or thelike.

The monitoring system 20 according to the embodiment is configured as amonitoring system for mutually monitoring the first and secondmicrocomputers 30 and 40 that drive and control the first and secondmotors 10 and 11, respectively, but instead may be configured as amonitoring system for mutually monitoring two control devices(microcomputers) that drive and control devices other than motors. Themonitoring system 20 according to the embodiment is mounted on anelectric vehicle or a hybrid vehicle, but instead may be mounted onvehicles other than an electric vehicle and a hybrid vehicle, and mobilebodies such as a ship and an aircraft, or may be mounted on immobileequipment such as construction equipment.

In the monitoring system of the above aspect, the reference resetrequest signal may be a signal having a predetermined pulse train. Inthis case, the predetermined pulse train may be a pulse train includinga first predetermined number of pulses, a predetermined period, and asecond predetermined number of pulses in this order. With theconfigurations as described above, when one of the first and secondcontrol devices is in the abnormal state, the reset request signal forthe counterpart control device to be output to the monitoring reset unitfrom the one of the first and second control devices can be preventedfrom matching the reference reset request signal.

In the monitoring system according to the present disclosure using asignal having a predetermined pulse train as the reference reset requestsignal, the monitoring reset unit may include a count unit that countsthe number of pulses of the reset request signal as a count value, and areset instruction unit that resets the counterpart control deviceassuming that the reset request signal matches the reference resetrequest signal when the count value is equal to or greater than apredetermined value. With this configuration, when the count unit andthe reset instruction unit assume that the reset request signal matchesthe reference reset request signal, the counterpart control device canbe reset. In this case, the monitoring reset unit may further include acycle monitoring unit that monitors a pulse cycle of the reset requestsignal, and the count unit may determine, based on the monitoring resultobtained by the cycle monitoring unit, whether or not to count thenumber of pulses of the reset request signal as the count value.

In the monitoring system according to the present disclosure using asignal having a predetermined pulse train as the reference reset requestsignal, the reset signal is a voltage signal having a Lo level or a Hilevel, and the monitoring reset unit may include a gradual changeprocessing unit configured to perform gradual change processing on thereset request signal to generate a processed voltage, and a resetinstruction unit configured to reset the counterpart control device,assuming that the reset request signal matches the reference resetrequest signal when the processed voltage is continuous over apredetermined period within a range of an upper/lower limitdetermination threshold. With this configuration, when the gradualchange processing unit and the reset instruction unit assume that thereset request signal matches the reference reset request signal, thecounterpart control device can be reset.

The following describes the correspondence relationship between theprimary components of the embodiment and the primary components of thedisclosure described in Summary. The first microcomputer 30 of theembodiment corresponds to the “first control device”; the secondmicrocomputer 40 corresponds to the “second control device”; and themonitoring microcomputer 50 corresponds to the “monitoring reset unit”.

The correspondence relationship between the primary components of theembodiment and the primary components of the disclosure, regarding whichthe problem is described in Summary, should not be considered to limitthe components of the disclosure, regarding which the problem isdescribed in Summary, since the embodiment is only illustrative tospecifically describes the aspects of the disclosure, regarding whichthe problem is described in Summary. In other words, the disclosure,regarding which the problem is described in Summary, should beinterpreted on the basis of the description in the Summary, and theembodiment is only a specific example of the disclosure, regarding whichthe problem is described in Summary.

The aspect of the disclosure is described above with reference to theembodiment. The disclosure is, however, not limited to the aboveembodiment but various modifications and variations may be made to theembodiment without departing from the scope of the disclosure.

INDUSTRIAL APPLICABILITY

The disclosure is applicable to, for example, the manufacturingindustries of monitoring systems.

1. A monitoring system for mutually monitoring first and second controldevices, the monitoring system comprising: a monitoring reset unitconfigured to monitor the first and second control devices and reset thefirst and second control devices, wherein when the first and secondcontrol devices detect an abnormality in a counterpart control device,the first and second control devices output, to the monitoring resetunit, a reset request signal that matches a reference reset requestsignal for the counterpart control device, respectively, and themonitoring reset unit resets the counterpart control device when thereset request signal for the counterpart control device from the firstand second control devices matches the reference reset request signal.2. The monitoring system according to claim 1, wherein the referencereset request signal is a signal having a predetermined pulse train. 3.The monitoring system according to claim 2, wherein the predeterminedpulse train is a pulse train including a first predetermined number ofpulses, a predetermined period, and a second predetermined number ofpulses in this order.
 4. The monitoring system according to claim 2,wherein the monitoring reset unit includes: a count unit configured tocount the number of pulses of the reset request signal as a count value;and a reset instruction unit configured to reset the counterpart controldevice, assuming that the reset request signal matches the referencereset request signal when the count value is equal to or greater than apredetermined value.
 5. The monitoring system according to claim 3,wherein the monitoring reset unit includes: a count unit configured tocount the number of pulses of the reset request signal as a count value;and a reset instruction unit configured to reset the counterpart controldevice, assuming that the reset request signal matches the referencereset request signal when the count value is equal to or greater than apredetermined value.
 6. The monitoring system according to claim 2,wherein the reset signal is a voltage signal having a Lo level or a Hilevel, and the monitoring reset unit includes: a gradual changeprocessing unit configured to perform gradual change processing on thereset request signal to generate a processed voltage; and a resetinstruction unit configured to reset the counterpart control device,assuming that the reset request signal matches the reference resetrequest signal when the processed voltage is continuous over apredetermined period within a range of an upper/lower limitdetermination threshold.
 7. The monitoring system according to claim 3,wherein the reset signal is a voltage signal having a Lo level or a Hilevel, and the monitoring reset unit includes: a gradual changeprocessing unit configured to perform gradual change processing on thereset request signal to generate a processed voltage; and a resetinstruction unit configured to reset the counterpart control device,assuming that the reset request signal matches the reference resetrequest signal when the processed voltage is continuous over apredetermined period within a range of an upper/lower limitdetermination threshold.